@salifbiaye/create-boutique 0.6.0 → 0.7.1

package/templates/backend/src/modules/paydunya/service.ts

@@ -0,0 +1,89 @@
+import { MedusaError } from "@medusajs/framework/utils"
+import { type Checkout, type PayStatus, RedirectPaymentProvider, sameHex, sha } from "../../lib/redirect-payment"
+
+type Options = {
+  master_key: string
+  private_key: string
+  token: string
+  /** « test » = sandbox PayDunya, « prod » = paiements réels */
+  env: "test" | "prod"
+  /** Nom affiché sur la page de paiement */
+  store_name?: string
+}
+
+/**
+ * PayDunya (paydunya.com) : Wave, Orange Money, Free Money, carte… sur une facture PayDunya (checkout-invoice).
+ * Doc : https://developers.paydunya.com/doc/FR/http_json — création POST /checkout-invoice/create,
+ * statut GET /checkout-invoice/confirm/{token}, notification (callback_url) en formulaire, champ data[…],
+ * authentifiée par data[hash] = SHA-512 de la clé principale. La session Medusa voyage dans custom_data.
+ * Devise : FCFA (XOF). Remboursement : dans le tableau de bord PayDunya.
+ */
+class PaydunyaProviderService extends RedirectPaymentProvider<Options> {
+  static identifier = "paydunya"
+  protected currencies = ["xof"]
+  protected hookId = "paydunya_paydunya"
+
+  static validateOptions(options: Record<string, unknown>) {
+    if (!options.master_key || !options.private_key || !options.token) {
+      throw new MedusaError(MedusaError.Types.INVALID_DATA, "PayDunya : PAYDUNYA_MASTER_KEY, PAYDUNYA_PRIVATE_KEY et PAYDUNYA_TOKEN requis")
+    }
+  }
+
+  private get api() {
+    return this.options.env === "prod" ? "https://app.paydunya.com/api/v1" : "https://app.paydunya.com/sandbox-api/v1"
+  }
+
+  private get headers() {
+    return {
+      "PAYDUNYA-MASTER-KEY": this.options.master_key,
+      "PAYDUNYA-PRIVATE-KEY": this.options.private_key,
+      "PAYDUNYA-TOKEN": this.options.token,
+    }
+  }
+
+  protected async createCheckout(c: Checkout) {
+    const name = [c.customer.first_name, c.customer.last_name].filter(Boolean).join(" ")
+    const res = await this.http<{ response_code?: string; response_text?: string; token?: string; description?: string }>(
+      `${this.api}/checkout-invoice/create`,
+      {
+        method: "POST",
+        headers: this.headers,
+        json: {
+          invoice: {
+            total_amount: c.amount,
+            description: c.label,
+            ...(name || c.customer.email || c.customer.phone ? { customer: { name, email: c.customer.email, phone: c.customer.phone } } : {}),
+          },
+          store: { name: this.options.store_name || c.label },
+          custom_data: { session_id: c.sessionId },
+          actions: { return_url: c.returnUrl, cancel_url: c.cancelUrl, ...(c.notifyUrl ? { callback_url: c.notifyUrl } : {}) },
+        },
+      }
+    )
+    if (res.response_code !== "00" || !res.token || !res.response_text) {
+      throw new MedusaError(MedusaError.Types.UNEXPECTED_STATE, `PayDunya : facture non créée (${res.description ?? res.response_text ?? "réponse inattendue"})`)
+    }
+    return { ref: res.token, redirect_url: res.response_text }
+  }
+
+  protected async fetchStatus(token: string): Promise<PayStatus> {
+    const res = await this.http<{ status?: string }>(`${this.api}/checkout-invoice/confirm/${encodeURIComponent(token)}`, { headers: this.headers })
+    const s = String(res.status ?? "").toLowerCase()
+    if (s === "completed") return "paid"
+    if (s === "cancelled" || s === "failed") return "failed"
+    return "pending"
+  }
+
+  protected parseWebhook(body: Record<string, unknown>) {
+    const data = (body.data ?? body) as Record<string, any>
+    if (!data?.hash || !sameHex(sha("sha512", this.options.master_key), String(data.hash))) return null
+    const custom = (data.custom_data ?? {}) as Record<string, unknown>
+    return {
+      ref: String(data.invoice?.token ?? ""),
+      sessionId: String(custom.session_id ?? ""),
+      amount: Number(data.invoice?.total_amount) || 0,
+    }
+  }
+}
+
+export default PaydunyaProviderService

package/templates/backend/src/modules/paytech/index.ts

@@ -0,0 +1,6 @@
+import { ModuleProvider, Modules } from "@medusajs/framework/utils"
+import PaytechProviderService from "./service"
+
+export default ModuleProvider(Modules.PAYMENT, {
+  services: [PaytechProviderService],
+})

package/templates/backend/src/modules/paytech/service.ts

@@ -0,0 +1,114 @@
+import { MedusaError } from "@medusajs/framework/utils"
+import { type Checkout, type PayStatus, RedirectPaymentProvider, hmac256, sameHex, sha } from "../../lib/redirect-payment"
+
+type Options = {
+  api_key: string
+  api_secret: string
+  /** « test » (débite 100 à 150 FCFA quel que soit le montant) ou « prod » (compte activé chez PayTech) */
+  env: "test" | "prod"
+}
+
+const API = "https://paytech.sn/api"
+
+/**
+ * PayTech (paytech.sn) : Wave, Orange Money, Free Money, carte bancaire… sur une page de paiement PayTech.
+ * Doc : https://docs.intech.sn/doc_paytech.php — création POST /payment/request-payment, statut GET /payment/get-status,
+ * IPN signée (HMAC-SHA256 « montant|ref_command|api_key » avec api_secret, ou SHA-256 des clés), remboursement.
+ * La référence du paiement Medusa (session) voyage dans custom_field.
+ */
+class PaytechProviderService extends RedirectPaymentProvider<Options> {
+  static identifier = "paytech"
+  protected currencies = ["xof", "eur", "usd", "cad", "gbp", "mad"]
+  protected hookId = "paytech_paytech"
+
+  static validateOptions(options: Record<string, unknown>) {
+    if (!options.api_key || !options.api_secret) {
+      throw new MedusaError(MedusaError.Types.INVALID_DATA, "PayTech : PAYTECH_API_KEY et PAYTECH_API_SECRET requis")
+    }
+  }
+
+  private get headers() {
+    return { API_KEY: this.options.api_key, API_SECRET: this.options.api_secret }
+  }
+
+  protected async createCheckout(c: Checkout) {
+    // Référence unique par tentative (la session peut créer plusieurs paiements si le panier change)
+    const ref = `${c.sessionId}_${Date.now().toString(36)}`
+    const res = await this.http<{ success?: number; token?: string; redirect_url?: string; redirectUrl?: string; message?: string }>(
+      `${API}/payment/request-payment`,
+      {
+        method: "POST",
+        headers: this.headers,
+        json: {
+          item_name: c.label,
+          item_price: c.amount,
+          currency: c.currency.toUpperCase(),
+          ref_command: ref,
+          command_name: c.label,
+          env: this.options.env === "prod" ? "prod" : "test",
+          ...(c.notifyUrl ? { ipn_url: c.notifyUrl } : {}),
+          success_url: c.returnUrl,
+          cancel_url: c.cancelUrl,
+          custom_field: JSON.stringify({ session_id: c.sessionId }),
+        },
+      }
+    )
+    const url = res.redirect_url ?? res.redirectUrl
+    if (res.success !== 1 || !res.token || !url) {
+      throw new MedusaError(MedusaError.Types.UNEXPECTED_STATE, `PayTech : paiement non créé (${res.message ?? "réponse inattendue"})`)
+    }
+    // ref = jeton PayTech (sert au statut) ; ref_command gardé pour le remboursement
+    return { ref: res.token, redirect_url: url, extra: { ref_command: ref } }
+  }
+
+  /**
+   * Le format exact de la réponse de get-status n'est pas documenté : lecture tolérante des champs usuels.
+   * L'IPN signée reste la voie sûre de confirmation (voir getWebhookActionAndData).
+   */
+  protected async fetchStatus(token: string): Promise<PayStatus> {
+    const res = await this.http<Record<string, any>>(`${API}/payment/get-status?token_payment=${encodeURIComponent(token)}`, { headers: this.headers })
+    const s = String(res.payment?.state ?? res.payment?.status ?? res.state ?? res.status ?? res.type_event ?? res.transaction?.status ?? "").toLowerCase()
+    if (/complet|success|paid|sale_complete|accepted/.test(s)) return "paid"
+    if (/cancel|fail|refus|expired|sale_canceled/.test(s)) return "failed"
+    return "pending"
+  }
+
+  protected parseWebhook(body: Record<string, unknown>) {
+    const f = (k: string) => (body[k] == null ? "" : String(body[k]))
+    const ref = f("token")
+    const refCommand = f("ref_command")
+    // Authenticité : HMAC (recommandé) sur le montant final ou initial, sinon empreintes SHA-256 des clés
+    const received = f("hmac_compute")
+    const okHmac =
+      !!received &&
+      [f("final_item_price"), f("item_price")].filter(Boolean).some((amount) => sameHex(hmac256(this.options.api_secret, `${amount}|${refCommand}|${this.options.api_key}`), received))
+    const okSha =
+      !!f("api_key_sha256") &&
+      sameHex(sha("sha256", this.options.api_key), f("api_key_sha256")) &&
+      sameHex(sha("sha256", this.options.api_secret), f("api_secret_sha256"))
+    if (!okHmac && !okSha) return null
+
+    let sessionId = ""
+    try {
+      const custom = f("custom_field")
+      const json = custom.trim().startsWith("{") ? custom : Buffer.from(custom, "base64").toString("utf8")
+      sessionId = String(JSON.parse(json).session_id ?? "")
+    } catch {
+      // repli : la référence commence par le numéro de session
+      sessionId = refCommand.slice(0, refCommand.lastIndexOf("_"))
+    }
+    return { ref, sessionId, amount: Number(f("final_item_price") || f("item_price")) || 0 }
+  }
+
+  /** Remboursement de la transaction (POST /payment/refund-payment avec ref_command) */
+  protected async refund(data: Record<string, unknown>) {
+    const res = await this.http<{ success?: number; message?: string }>(`${API}/payment/refund-payment`, {
+      method: "POST",
+      headers: this.headers,
+      json: { ref_command: String(data.ref_command ?? "") },
+    })
+    if (res.success !== 1) throw new MedusaError(MedusaError.Types.UNEXPECTED_STATE, `PayTech : remboursement refusé (${res.message ?? "réponse inattendue"})`)
+  }
+}
+
+export default PaytechProviderService

package/templates/backend/src/modules/product-review/index.ts

@@ -0,0 +1,8 @@
+import { Module } from "@medusajs/framework/utils"
+import ProductReviewModuleService from "./service"
+
+export const PRODUCT_REVIEW_MODULE = "productReview"
+
+export default Module(PRODUCT_REVIEW_MODULE, {
+  service: ProductReviewModuleService,
+})

package/templates/backend/src/modules/product-review/migrations/Migration20261001090000.ts

@@ -0,0 +1,18 @@
+import { Migration } from "@medusajs/framework/mikro-orm/migrations";
+
+// Écrite à la main (même forme que celles générées par `medusa db:generate productReview`) : table des avis.
+export class Migration20261001090000 extends Migration {
+
+  override async up(): Promise<void> {
+    this.addSql(`create table if not exists "product_review" ("id" text not null, "product_id" text not null, "sales_channel_id" text not null, "order_id" text not null, "customer_email" text not null, "author_name" text not null, "rating" integer not null, "title" text null, "comment" text not null, "status" text check ("status" in ('pending', 'approved', 'rejected')) not null default 'pending', "created_at" timestamptz not null default now(), "updated_at" timestamptz not null default now(), "deleted_at" timestamptz null, constraint "product_review_pkey" primary key ("id"));`);
+    this.addSql(`CREATE INDEX IF NOT EXISTS "IDX_product_review_product_id" ON "product_review" ("product_id") WHERE deleted_at IS NULL;`);
+    this.addSql(`CREATE INDEX IF NOT EXISTS "IDX_product_review_sales_channel_id" ON "product_review" ("sales_channel_id") WHERE deleted_at IS NULL;`);
+    this.addSql(`CREATE UNIQUE INDEX IF NOT EXISTS "IDX_product_review_order_id_product_id_unique" ON "product_review" ("order_id", "product_id") WHERE deleted_at IS NULL;`);
+    this.addSql(`CREATE INDEX IF NOT EXISTS "IDX_product_review_deleted_at" ON "product_review" ("deleted_at") WHERE deleted_at IS NULL;`);
+  }
+
+  override async down(): Promise<void> {
+    this.addSql(`drop table if exists "product_review" cascade;`);
+  }
+
+}

package/templates/backend/src/modules/product-review/models/review.ts

@@ -0,0 +1,25 @@
+import { model } from "@medusajs/framework/utils"
+
+/**
+ * Avis client sur un produit. Seul un acheteur peut en laisser un (lien signé de l'e-mail « commande livrée »),
+ * une fois par produit et par commande ; il n'est affiché qu'après validation dans l'admin (page Avis).
+ * sales_channel_id = boutique d'où vient la commande : l'admin filtre par boutique, et le site affiche les avis
+ * de toutes les boutiques (réglage « shared », défaut) ou seulement les siens (« boutique », project.json → defaults.reviews).
+ * customer_email n'est jamais renvoyé par les routes publiques.
+ */
+const Review = model
+  .define("product_review", {
+    id: model.id({ prefix: "prev" }).primaryKey(),
+    product_id: model.text().index(),
+    sales_channel_id: model.text().index(),
+    order_id: model.text(),
+    customer_email: model.text(),
+    author_name: model.text(),
+    rating: model.number(),
+    title: model.text().nullable(),
+    comment: model.text(),
+    status: model.enum(["pending", "approved", "rejected"]).default("pending"),
+  })
+  .indexes([{ on: ["order_id", "product_id"], unique: true }])
+
+export default Review

package/templates/backend/src/modules/product-review/service.ts

@@ -0,0 +1,6 @@
+import { MedusaService } from "@medusajs/framework/utils"
+import Review from "./models/review"
+
+class ProductReviewModuleService extends MedusaService({ Review }) {}
+
+export default ProductReviewModuleService

package/templates/backend/src/modules/product-review/validators.ts

@@ -0,0 +1,27 @@
+import { z } from "@medusajs/framework/zod"
+
+/** Texte simple uniquement (aucun < ou >), espaces superflus retirés, longueur bornée */
+const plain = (min: number, max: number) =>
+  z
+    .string()
+    .trim()
+    .min(min)
+    .max(max)
+    .refine((v) => !/[<>]/.test(v), "Texte simple uniquement (pas de HTML)")
+
+/** POST /store/reviews : avis d'un acheteur (jeton du lien de l'e-mail « commande livrée ») */
+export const ReviewInput = z.object({
+  token: z.string().min(10).max(300),
+  product_id: z.string().min(1).max(100),
+  rating: z.number().int().min(1).max(5),
+  title: plain(0, 80).optional(),
+  comment: plain(10, 1000),
+  author_name: plain(1, 40),
+})
+export type ReviewInput = z.infer<typeof ReviewInput>
+
+/** POST /admin/reviews/:id : valider, refuser, remettre en attente */
+export const ReviewStatusInput = z.object({
+  status: z.enum(["pending", "approved", "rejected"]),
+})
+export type ReviewStatusInput = z.infer<typeof ReviewStatusInput>

package/templates/backend/src/modules/smtp/index.ts

@@ -0,0 +1,6 @@
+import { ModuleProvider, Modules } from "@medusajs/framework/utils"
+import SmtpNotificationProviderService from "./service"
+
+export default ModuleProvider(Modules.NOTIFICATION, {
+  services: [SmtpNotificationProviderService],
+})

package/templates/backend/src/modules/smtp/service.ts

@@ -0,0 +1,73 @@
+import { Logger, NotificationTypes } from "@medusajs/framework/types"
+import { AbstractNotificationProviderService, MedusaError } from "@medusajs/framework/utils"
+import nodemailer, { type Transporter } from "nodemailer"
+
+type Options = {
+  host: string
+  /** 465 = SSL direct (Gmail), 587 = STARTTLS */
+  port: number
+  user: string
+  /** Mot de passe SMTP ; pour Gmail : mot de passe d'application (16 caractères), jamais le mot de passe du compte */
+  pass: string
+  /** Adresse « De : » ; pour Gmail, la même adresse que user (sinon Gmail la remplace ou le message est rejeté) */
+  from: string
+}
+
+type InjectedDependencies = { logger: Logger }
+
+/**
+ * Envoi des e-mails par un serveur SMTP (Gmail avec mot de passe d'application, OVH, Brevo, Mailjet…),
+ * alternative à Resend. Même contrat que le provider Resend : le contenu est préparé par src/lib/emails.ts,
+ * data.fromName = nom de la boutique (nom affiché), data.replyTo = e-mail du marchand.
+ */
+class SmtpNotificationProviderService extends AbstractNotificationProviderService {
+  static identifier = "notification-smtp"
+
+  private transporter: Transporter
+  private options: Options
+  private logger: Logger
+
+  static validateOptions(options: Record<string, unknown>) {
+    for (const k of ["host", "user", "pass", "from"]) {
+      if (!options[k]) throw new MedusaError(MedusaError.Types.INVALID_DATA, `SMTP : option ${k} manquante`)
+    }
+  }
+
+  constructor({ logger }: InjectedDependencies, options: Options) {
+    super()
+    this.options = options
+    this.logger = logger
+    this.transporter = nodemailer.createTransport({
+      host: options.host,
+      port: options.port,
+      secure: options.port === 465,
+      auth: { user: options.user, pass: options.pass },
+    })
+  }
+
+  async send(notification: NotificationTypes.ProviderSendNotificationDTO): Promise<NotificationTypes.ProviderSendNotificationResultsDTO> {
+    const { content, data } = notification
+    if (!content?.subject || !content.html) {
+      throw new MedusaError(MedusaError.Types.INVALID_DATA, `SMTP : contenu manquant pour ${notification.template}`)
+    }
+    const fromName = typeof data?.fromName === "string" ? data.fromName.replace(/[<>"]/g, "") : undefined
+    const replyTo = typeof data?.replyTo === "string" ? data.replyTo : undefined
+    try {
+      const info = await this.transporter.sendMail({
+        from: fromName ? { name: fromName, address: this.options.from } : this.options.from,
+        to: notification.to,
+        subject: content.subject,
+        html: content.html,
+        text: content.text,
+        ...(replyTo ? { replyTo } : {}),
+      })
+      return { id: info.messageId }
+    } catch (e) {
+      const message = (e as Error).message
+      this.logger.error(`[smtp] ${notification.template} → ${notification.to} : ${message}`)
+      throw new MedusaError(MedusaError.Types.UNEXPECTED_STATE, message)
+    }
+  }
+}
+
+export default SmtpNotificationProviderService

package/templates/backend/src/scripts/seed.ts

@@ -2,7 +2,7 @@
  * Seed idempotent, lancé à chaque démarrage du container backend (docker/entrypoint.sh).
  * Lit config/project.json et crée seulement ce qui manque :
  *  - devises du store, une région par devise (un pays = une devise), régions de taxe ;
- *  - entrepôt, zone de livraison « Monde », options Standard / Express par devise ;
+ *  - entrepôt, zone de livraison « Monde », options Standard / Express créées au 1er démarrage seulement (ensuite : admin) ;
  *  - 1 sales channel + 1 publishable key par boutique, clé écrite dans KEYS_DIR/<slug> ;
  *  - produits de seed/products.csv (par handle) et images de seed/images.
  * Aucun SQL : uniquement les workflows et services Medusa.
@@ -38,6 +38,7 @@ import { CAMPAIGN_MODULE } from "../modules/campaign"
 import CampaignModuleService from "../modules/campaign/service"
 import { CampaignFile, CampaignInput } from "../modules/campaign/validators"
 import { upsertCampaignWorkflow } from "../workflows/upsert-campaign"
+import { regionPaymentProviders } from "../lib/payment-config"
 
 const LOCATION_NAME = "Entrepôt principal"
 const FULFILLMENT_SET_NAME = "Livraison"
@@ -63,6 +64,10 @@ export default async function seed({ container }: ExecArgs) {
   // ---------- Store : devises ----------
   const [store] = await storeService.listStores({}, { relations: ["supported_currencies"] })
   const knownCurrencies = new Set(store.supported_currencies?.map((c) => c.currency_code))
+  // Nom affiché en haut de l'admin : celui du projet (pas « Medusa Store »)
+  if (store.name === "Medusa Store" || !store.name) {
+    await updateStoresWorkflow(container).run({ input: { selector: { id: store.id }, update: { name: project.boutiques[0].storeName } } })
+  }
   if (currencies.some((c) => !knownCurrencies.has(c)) || !store.supported_currencies?.find((c) => c.is_default && c.currency_code === project.defaultCurrency)) {
     await updateStoresWorkflow(container).run({
       input: {
@@ -78,7 +83,6 @@ export default async function seed({ container }: ExecArgs) {
   // ---------- Régions : une par devise ----------
   const allCountries = (await regionService.listCountries({}, { take: 500 })).map((c) => c.iso_2)
   const target = countriesByCurrency(project, allCountries)
-  const paymentProviders = ["pp_system_default", ...(process.env.STRIPE_API_KEY ? ["pp_stripe_stripe"] : [])]
   const existing = await regionService.listRegions({}, { relations: ["countries"] })
   const managed = new Map(existing.filter((r) => currencies.includes(r.currency_code) && r.name === r.currency_code.toUpperCase()).map((r) => [r.currency_code, r]))
 
@@ -102,11 +106,11 @@ export default async function seed({ container }: ExecArgs) {
     const region = managed.get(currency)
     if (region) {
       await updateRegionsWorkflow(container).run({
-        input: { selector: { id: region.id }, update: { countries: [...countries], payment_providers: paymentProviders } },
+        input: { selector: { id: region.id }, update: { countries: [...countries], payment_providers: regionPaymentProviders(currency) } },
       })
     } else {
       await createRegionsWorkflow(container).run({
-        input: { regions: [{ name: currency.toUpperCase(), currency_code: currency, countries: [...countries], payment_providers: paymentProviders }] },
+        input: { regions: [{ name: currency.toUpperCase(), currency_code: currency, countries: [...countries], payment_providers: regionPaymentProviders(currency) }] },
       })
     }
     logger.info(`[seed] région ${currency.toUpperCase()} : ${countries.size} pays`)
@@ -159,45 +163,57 @@ export default async function seed({ container }: ExecArgs) {
     { attribute: "enabled_in_store", value: "true", operator: "eq" as const },
     { attribute: "is_return", value: "false", operator: "eq" as const },
   ]
-  for (const [i, name, code, description] of [
+  const DEFAULT_OPTIONS = [
     [0, "Standard", "standard", "3-7 business days"],
     [1, "Express", "express", "1-3 business days"],
-  ] as const) {
-    // Prix liés via le module Pricing : demandés par query.graph mais absents du type généré.
-    const option = options.find((o) => o.name === name) as
-      | { id: string; prices?: { id: string; amount: number; currency_code: string }[] }
-      | undefined
-    if (!option) {
-      await createShippingOptionsWorkflow(container).run({
+  ] as const
+  // Prix liés via le module Pricing : demandés par query.graph mais absents du type généré.
+  type PricedOption = { id: string; name: string; prices?: { id: string; amount: number; currency_code: string }[] }
+
+  // Standard et Express ne sont créées qu'une fois (1er démarrage). Ensuite, c'est l'admin qui décide : le marchand peut
+  // les renommer, changer les prix, en supprimer une, en ajouter d'autres ; le seed ne les recrée jamais.
+  // (Projet existant : des options déjà présentes valent « déjà fait ».)
+  const shippingSeeded = store.metadata?.ub_shipping_seeded === true || options.length > 0
+  if (!shippingSeeded) {
+    await createShippingOptionsWorkflow(container).run({
+      input: DEFAULT_OPTIONS.map(([i, name, code, description]) => ({
+        name,
+        price_type: "flat" as const,
+        provider_id: "manual_manual",
+        service_zone_id: zone.id,
+        shipping_profile_id: profile.id,
+        type: { label: name, description, code },
+        prices: currencies.map((c) => ({ currency_code: c, amount: shippingRates(c)[i] })),
+        rules,
+      })),
+    })
+    await updateStoresWorkflow(container).run({
+      input: { selector: { id: store.id }, update: { metadata: { ...(store.metadata ?? {}), ub_shipping_seeded: true } } },
+    })
+  } else {
+    if (store.metadata?.ub_shipping_seeded !== true) {
+      await updateStoresWorkflow(container).run({
+        input: { selector: { id: store.id }, update: { metadata: { ...(store.metadata ?? {}), ub_shipping_seeded: true } } },
+      })
+    }
+    // Nouvelle devise (boutique ajoutée) : prix ajouté aux options existantes, quel que soit leur nom (tarif Express
+    // pour une option nommée « Express », tarif Standard sinon). Les prix déjà fixés dans l'admin ne sont pas touchés.
+    for (const option of options as PricedOption[]) {
+      const tier = /express/i.test(option.name) ? 1 : 0
+      const priced = new Set((option.prices ?? []).map((p) => p.currency_code))
+      const add = currencies.filter((c) => !priced.has(c))
+      if (!add.length) continue
+      await updateShippingOptionsWorkflow(container).run({
         input: [
           {
-            name,
-            price_type: "flat",
-            provider_id: "manual_manual",
-            service_zone_id: zone.id,
-            shipping_profile_id: profile.id,
-            type: { label: name, description, code },
-            prices: currencies.map((c) => ({ currency_code: c, amount: shippingRates(c)[i] })),
-            rules,
+            id: option.id,
+            prices: [
+              ...(option.prices ?? []).map((p) => ({ id: p.id, amount: p.amount })),
+              ...add.map((c) => ({ currency_code: c, amount: shippingRates(c)[tier] })),
+            ],
           },
         ],
       })
-    } else {
-      const priced = new Set((option.prices ?? []).map((p) => p.currency_code))
-      const add = currencies.filter((c) => !priced.has(c))
-      if (add.length) {
-        await updateShippingOptionsWorkflow(container).run({
-          input: [
-            {
-              id: option.id,
-              prices: [
-                ...(option.prices ?? []).map((p) => ({ id: p.id, amount: p.amount })),
-                ...add.map((c) => ({ currency_code: c, amount: shippingRates(c)[i] })),
-              ],
-            },
-          ],
-        })
-      }
     }
   }
 

package/templates/backend/src/subscribers/fulfillment-emails.ts

@@ -24,7 +24,7 @@ export default async function fulfillmentEmails({
   if (!orderId) return
 
   if (name === "delivery.created") {
-    await sendOrderEmail(container, orderId, "order_delivered")
+    await sendOrderEmail(container, orderId, "order_delivered", { reviewLink: true })
     return
   }
 

package/templates/backend/src/workflows/reviews.ts

@@ -0,0 +1,21 @@
+import { createWorkflow, WorkflowResponse } from "@medusajs/framework/workflows-sdk"
+import { type CreateReviewData, createReviewStep } from "./steps/create-review"
+import { deleteReviewStep, updateReviewStatusStep } from "./steps/update-review"
+
+/** Avis d'un acheteur (lien signé de l'e-mail « commande livrée ») : en attente de validation. */
+export const createReviewWorkflow = createWorkflow("create-review", function (input: CreateReviewData) {
+  return new WorkflowResponse(createReviewStep(input))
+})
+
+/** Admin → Avis : valider, refuser, remettre en attente. */
+export const updateReviewStatusWorkflow = createWorkflow(
+  "update-review-status",
+  function (input: { id: string; status: "pending" | "approved" | "rejected" }) {
+    return new WorkflowResponse(updateReviewStatusStep(input))
+  }
+)
+
+/** Admin → Avis : supprimer. */
+export const deleteReviewWorkflow = createWorkflow("delete-review", function (input: { id: string }) {
+  return new WorkflowResponse(deleteReviewStep(input.id))
+})

package/templates/backend/src/workflows/steps/create-review.ts

@@ -0,0 +1,52 @@
+import { ContainerRegistrationKeys, MedusaError } from "@medusajs/framework/utils"
+import { createStep, StepResponse } from "@medusajs/framework/workflows-sdk"
+import { PRODUCT_REVIEW_MODULE } from "../../modules/product-review"
+import ProductReviewModuleService from "../../modules/product-review/service"
+
+export type CreateReviewData = {
+  order_id: string
+  product_id: string
+  rating: number
+  title?: string
+  comment: string
+  author_name: string
+}
+
+/**
+ * Crée un avis « en attente » après vérifications : la commande existe, le produit en fait partie,
+ * pas déjà d'avis pour ce produit dans cette commande. Boutique et e-mail pris dans la commande (jamais du client).
+ * Rollback : supprime l'avis créé.
+ */
+export const createReviewStep = createStep(
+  "create-review",
+  async (input: CreateReviewData, { container }) => {
+    const query = container.resolve(ContainerRegistrationKeys.QUERY)
+    const { data } = await query.graph({
+      entity: "order",
+      fields: ["id", "email", "sales_channel_id", "status", "items.product_id"],
+      filters: { id: input.order_id },
+    })
+    const order = data[0]
+    if (!order || order.status === "canceled") throw new MedusaError(MedusaError.Types.NOT_FOUND, "Commande introuvable")
+    if (!(order.items ?? []).some((i) => i?.product_id === input.product_id)) {
+      throw new MedusaError(MedusaError.Types.NOT_ALLOWED, "Ce produit ne fait pas partie de la commande")
+    }
+    const service: ProductReviewModuleService = container.resolve(PRODUCT_REVIEW_MODULE)
+    const [already] = await service.listReviews({ order_id: order.id, product_id: input.product_id })
+    if (already) throw new MedusaError(MedusaError.Types.DUPLICATE_ERROR, "Un avis existe déjà pour ce produit")
+
+    const review = await service.createReviews({
+      ...input,
+      title: input.title || null,
+      sales_channel_id: order.sales_channel_id ?? "",
+      customer_email: order.email ?? "",
+      status: "pending",
+    })
+    return new StepResponse(review, review.id)
+  },
+  async (id, { container }) => {
+    if (!id) return
+    const service: ProductReviewModuleService = container.resolve(PRODUCT_REVIEW_MODULE)
+    await service.deleteReviews(id)
+  }
+)

package/templates/backend/src/workflows/steps/update-review.ts

@@ -0,0 +1,36 @@
+import { createStep, StepResponse } from "@medusajs/framework/workflows-sdk"
+import { PRODUCT_REVIEW_MODULE } from "../../modules/product-review"
+import ProductReviewModuleService from "../../modules/product-review/service"
+
+type Status = "pending" | "approved" | "rejected"
+
+/** Change le statut d'un avis (valider, refuser) ; rollback : statut précédent. */
+export const updateReviewStatusStep = createStep(
+  "update-review-status",
+  async (input: { id: string; status: Status }, { container }) => {
+    const service: ProductReviewModuleService = container.resolve(PRODUCT_REVIEW_MODULE)
+    const previous = await service.retrieveReview(input.id)
+    const updated = await service.updateReviews({ id: input.id, status: input.status })
+    return new StepResponse(updated, { id: input.id, status: previous.status as Status })
+  },
+  async (prev, { container }) => {
+    if (!prev) return
+    const service: ProductReviewModuleService = container.resolve(PRODUCT_REVIEW_MODULE)
+    await service.updateReviews(prev)
+  }
+)
+
+/** Supprime un avis (suppression douce) ; rollback : restauration. */
+export const deleteReviewStep = createStep(
+  "delete-review",
+  async (id: string, { container }) => {
+    const service: ProductReviewModuleService = container.resolve(PRODUCT_REVIEW_MODULE)
+    await service.softDeleteReviews(id)
+    return new StepResponse(id, id)
+  },
+  async (id, { container }) => {
+    if (!id) return
+    const service: ProductReviewModuleService = container.resolve(PRODUCT_REVIEW_MODULE)
+    await service.restoreReviews(id)
+  }
+)